EventPrime – Events Calendar, Bookings and Tickets

Vulnerabilities 44Slug eventprime-event-calendar-managementLatest version 4.3.2.3WordPress.org →

Minimum safe version

4.3.0.1

Update to 4.3.0.1 or later to address 44 fixable vulnerabilities

Latest available4.3.2.3 ✓
N/A
2026-04-20< 4.3.0.1

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference

WordfenceCVE
N/A
2026-02-16< 4.2.8.5

EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

WordfenceCVE
N/A
2026-02-17< 4.2.8.5

EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter

WordfenceCVE
Critical 9.8
2026-03-25< 4.2.8.1

CVE-2026-24378

CVEWordfence
Medium 5.3
2026-02-20< 4.2.8.4

EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure

WordfenceCVE
Medium 5.3
2026-01-28< 4.2.8.1

EventPrime <= 4.2.8.0 - Missing Authorization

WordfenceCVE
Medium 5.3
2026-01-13< 4.2.8.0

CVE-2025-14507

CVEWordfence
Medium 4.3
2025-12-09< 4.2.5.0

CVE-2025-63007

CVEWordfence
Medium 4.3
2025-11-08< 4.2.0.1

CVE-2025-12498

CVEWordfence
Medium 5.3
2025-05-15< 3.5.0

EventPrime – Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update

EUVDWordfenceCVE
N/A
< 3.3.3

EventPrime &ndash; Modern Events Calendar, Bookings and Tickets &lt; 3.3.3 - Contributor+ Stored XSS

WPScan
N/A
< 3.4.0

WordPress EventPrime Plugin <= 3.3.9 is vulnerable to Broken Access Control

Patchstack
N/A
2023-11-23< 3.3.3

WordPress EventPrime Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2023-11-21< 3.3.3

EventPrime – Modern Events Calendar, Bookings and Tickets <= 3.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

Wordfence
Medium 4.3
2023-10-31< 3.2.0

CVE-2023-5519

CVE